The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm ...

GitHub releases npm 12 with install scripts off by default and begins phasing out 2FA bypass tokens for sensitive npm actions ...

Malicious jscrambler 8.14.0 runs hidden binaries during npm install on Windows, macOS, and Linux, with no fix available as of ...

Hackers compromised the Injective Labs SDK project's GitHub repository and used it to publish a malicious package on the Node ...

Malicious Jscrambler NPM package versions distributed a cross-platform credential stealer in a new supply chain attack.

Injective says the npm supply chain issue was resolved before downloads, with zero user funds at risk or compromised.

Socket found a compromised Injective npm package stealing wallet keys amid rising crypto supply chain attacks.

Injective has dismissed concerns that user funds were compromised after attackers planted wallet-key-stealing code in 18 of ...

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This ...

JavaScript engineering teams have a shrinking window to prepare: npm v12, the package manager's most significant security redesign in its 16-year history, is expected to reach final release before the ...

Vivani said it expects to begin a Phase 1, randomised, first-in-human study of NPM-139 in mid-2026, using Novo Nordisk's ...

Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import time — not install time — evading npm v12’s script-blocking defaults and ...